# Lampion Banking Trojan (ChePro Lineage) Multistage Phishing/Evasion Campaign Targets Portugal

> Acronis Threat Research Unit identified an active phishing campaign delivering the Lampion (ChePro-lineage) Brazilian banking RAT to Portuguese-speaking users, primarily in Portugal (94.6% of detections), with smaller volumes in Spain (4.3%) and the UK (1.1%). The campaign uses a four-stage HTML/JavaScript/VBS infection chain with heavy obfuscation, junk-code padding, encrypted URLs, and HTTP range-request payload delivery to evade static analysis, culminating in a rundll32-launched RAT DLL exporting the function "jangadeiro" for remote access and data exfiltration.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1619
- **ID:** TL-2026-1619
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Lampion
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Lampion is a Brazilian banking trojan derived from the ChePro malware lineage (Trojan-Banker.Win32.ChePro, first observed in Russia in October 2012, historically concentrated in Brazil and Portugal due to shared language). Lampion itself was first publicly documented on 2019-12-26 by Segurança Informática, spreading via phishing emails templated on Portuguese Government Finance & Tax communications. The family has remained active and continuously refined its delivery tradecraft through 2020-2025, including a Unit 42-documented resurgence (late 2024-early 2025) against Portuguese government, finance, and transportation organizations using ClickFix-style PowerShell lures and C2 infrastructure reuse tied back to prior Lampion infections.

The campaign profiled here (Acronis TRU, published 2026-07-21) begins with a phishing email carrying a password-protected or plain ZIP archive impersonating financial/administrative correspondence. Inside is an HTML file artificially inflated to roughly 1.3 MB with random junk content and padding, rendering a fake "SAPO Transfer" portal page. Embedded JavaScript on this page retrieves a second-stage payload from an encrypted URL and dynamically injects/executes it. Stage 2 is an obfuscated VBS downloader roughly 7 MB in size but containing only ~22 KB of functional code (the remainder is junk-code padding used to defeat static/AV signature analysis); it writes a further downloader script to a temp directory and registers a Windows Task Scheduler task to launch the next stage. Stage 3 is a ~1,000-line VBS component that enforces single-instance execution via WMI process checks, fingerprints the victim (username, hostname, BIOS, motherboard, and GPU identifiers) to build a persistent victim ID, polls command-and-control infrastructure for a payload URL, and retrieves the final payload in 10 MB HTTP range-request chunks reassembled via an ADODB.Stream object — a technique that defeats network content-inspection tools expecting a single monolithic download. Intermediate VBS files self-delete after each stage, and scheduled tasks relocate/rename downloaded artifacts and can self-restart the chain roughly every 5 minutes if a stage fails.

The final payload is a DLL roughly 750 KB of genuine code padded to a much larger on-disk footprint (researchers describe the resulting artifact size, ~750 MB in some reporting of the padded form, as being driven entirely by junk padding rather than functional complexity), deployed into a timestamp-named folder under the user's AppData directory and executed via `rundll32.exe`, invoking an exported function named "jangadeiro" (Portuguese for the fisherman who pilots a jangada raft — consistent with the malware's Brazilian cultural origin). This DLL is the operational RAT component, providing remote access, screen/window monitoring typical of Latin American/Iberian banking trojans, credential and banking-session interception, and data exfiltration back to attacker infrastructure.

Operators use geofencing/victim-tracking controls so that payloads are only delivered to victims matching expected geography/locale, restricting analysis by researchers outside the target regions and explaining the concentrated 94.6% Portugal detection rate. C2 hosts are described as time-bound and potentially reassigned, consistent with Lampion's historical use of disposable or rotated infrastructure and, in earlier campaigns, abuse of legitimate cloud hosting (AWS S3, Google Drive) for payload staging.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1218.011 Rundll32
- T1053.005 Scheduled Task
- T1027 Obfuscated Files or Information
- T1027.001 Binary Padding
- T1218.011 Rundll32
- T1070.004 File Deletion
- T1497 Virtualization/Sandbox Evasion
- T1140 Deobfuscate/Decode Files or Information
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1057 Process Discovery
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1132.001 Standard Encoding
- T1056 Input Capture
- T1113 Screen Capture
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [Lampion's Portugal-focused phishing campaign delivers multistage malware](https://www.acronis.com/en/tru/posts/lampions-portugal-focused-phishing-campaign-delivers-multistage-malware/)
- [Acronis Researchers Uncover Active Lampion Malware Campaign Targeting Portugal With Multi-Stage Evasion Chain](https://smbtech.au/news/acronis-researchers-uncover-active-lampion-malware-campaign-targeting-portugal-with-multi-stage-evasion-chain/)
- [Lampion malware campaign targets users in Portugal](https://itbrief.co.nz/story/lampion-malware-campaign-targets-users-in-portugal)
- [Lampion malware campaign targets users in Portugal (SecurityBrief UK mirror)](https://securitybrief.co.uk/story/lampion-malware-campaign-targets-users-in-portugal)
- [Lampion Is Back With ClickFix Lures](https://unit42.paloaltonetworks.com/lampion-malware-clickfix-lures/)
- [vbs.lampion (Malware Family)](https://malpedia.caad.fkie.fraunhofer.de/details/vbs.lampion)
- [A new trojan dubbed Lampion is targeting Portugal](https://securityaffairs.com/95731/malware/lampion-malware-targets-portugal.html)
- [Targeting Portugal: A new trojan 'Lampion' has spread using template emails from the Portuguese Government Finance & Tax](https://seguranca-informatica.pt/targeting-portugal-a-new-trojan-lampion-has-spread-using-template-emails-from-the-portuguese-government-finance-tax/)
- [New release of Lampion trojan spreads in Portugal with some improvements on the VBS downloader](https://securityaffairs.com/105634/malware/new-release-lampion-trojan.html)
- [Trojan ChePro, the CPL Storm](https://securelist.com/trojan-chepro-the-cpl-storm/58203/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1619